registry / ata-validator / 1.0.0

ata-validator@1.0.0

JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 384 KB of source, external domains: ata-validator.com, json-schema.org

Source & flagged code

4 flagged

package.jsonView file

Lines 24-64json

24 "types": "./build.d.ts",

25 "import": "./build.mjs",

26 "require": "./build.js"

27 },

28 "./t": {

29 "types": "./t.d.ts",

30 "import": "./t.mjs",

31 "require": "./t.js"

32 },

33 "./package.json": "./package.json"

34 },

35 "sideEffects": false,

36 "bin": {

37 "ata": "bin/ata.js"

38 },

39 "browser": {

40 "pkg-prebuilds": false,

41 "./lib/native-load.js": "./lib/native-load.browser.js"

42 },

43 "scripts": {

44 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "prepublishOnly": "node scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && ATA_ALLOW_DOC_PLACEHOLDERS=1 node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",

46 "release:check": "node scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",

47 "build": "cmake-js build --target ata",

48 "rebuild": "cmake-js rebuild --target ata",

49 "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",

50 "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",

51 "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests ...

52 "bench:size": "node benchmark/bench_aot_size.mjs",

53 "test:suite": "node tests/run_suite.js",

54 "test:compat": "node tests/test_compat.js",

55 "test:standard-schema": "node tests/test_standard_schema.js",

56 "test:browser": "node tests/test_browser.js",

57 "test:ts": "node tests/test_ts_gen.js",

58 "test:ts-corpus": "node tests/test_ts_corpus.js",

59 "test:ts-differential": "node tests/test_ts_differential.js",

60 "test:typed": "node tests/test_typed_validator_runner.js",

61 "bench": "node benchmark/bench_large.js",

62 "fuzz": "node tests/fuzz_differential.js",

63 "fuzz:long": "FUZZ_ITERATIONS=100000 node tests/fuzz_differential.js",

64 "test:aot": "node tests/test_aot_build.js",

Long lines were clipped for display.

index.jsView file

Lines 245-285javascript

245 lines.push(`if(d[${k}]==='false'||d[${k}]==='0')d[${k}]=false`);

246 } else if (t === 'array' && options.coerceTypes === 'array') {

247 lines.push(`if(${k} in d&&d[${k}]!==undefined&&!Array.isArray(d[${k}]))d[${

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView file

•path = prebuilds/ata-linux-arm64-musl/node-napi-v10.node kind = native_binary sizeBytes = 1247656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

265try { L266: return new Function('d', lines.join('\n')); L267: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L265

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView file

•path = prebuilds/ata-linux-arm64-musl/node-napi-v10.node kind = native_binary sizeBytes = 1247656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView on unpkg

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binaryprebuilds/ata-linux-arm64-musl/node-napi-v10.node

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 24-64json

24 "types": "./build.d.ts",

25 "import": "./build.mjs",

26 "require": "./build.js"

27 },

28 "./t": {

29 "types": "./t.d.ts",

30 "import": "./t.mjs",

31 "require": "./t.js"

32 },

33 "./package.json": "./package.json"

34 },

35 "sideEffects": false,

36 "bin": {

37 "ata": "bin/ata.js"

38 },

39 "browser": {

40 "pkg-prebuilds": false,

41 "./lib/native-load.js": "./lib/native-load.browser.js"

42 },

43 "scripts": {

44 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

47 "build": "cmake-js build --target ata",

48 "rebuild": "cmake-js rebuild --target ata",

49 "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",

50 "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",

52 "bench:size": "node benchmark/bench_aot_size.mjs",

53 "test:suite": "node tests/run_suite.js",

54 "test:compat": "node tests/test_compat.js",

55 "test:standard-schema": "node tests/test_standard_schema.js",

56 "test:browser": "node tests/test_browser.js",

57 "test:ts": "node tests/test_ts_gen.js",

58 "test:ts-corpus": "node tests/test_ts_corpus.js",

59 "test:ts-differential": "node tests/test_ts_differential.js",

60 "test:typed": "node tests/test_typed_validator_runner.js",

61 "bench": "node benchmark/bench_large.js",

62 "fuzz": "node tests/fuzz_differential.js",

63 "fuzz:long": "FUZZ_ITERATIONS=100000 node tests/fuzz_differential.js",

64 "test:aot": "node tests/test_aot_build.js",

Long lines were clipped for display.

index.jsView file

Lines 245-285javascript

245 lines.push(`if(d[${k}]==='false'||d[${k}]==='0')d[${k}]=false`);

246 } else if (t === 'array' && options.coerceTypes === 'array') {

247 lines.push(`if(${k} in d&&d[${k}]!==undefined&&!Array.isArray(d[${k}]))d[${

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView file

•path = prebuilds/ata-linux-arm64-musl/node-napi-v10.node kind = native_binary sizeBytes = 1247656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView on unpkg